1. Field of the Disclosure
The present disclosure relates generally to malicious code detection methods and systems and in particular, to methods and systems that use heuristics logic for detecting malicious computer code.
2. Description of the Related Art
Antivirus (AV) systems may use various methods for detecting malicious code. Malicious code as referred to herein may include a computer virus capable of replicating itself and spreading. More specifically, malicious code may be understood to include, for example, a piece of software that may be designed and written to make additional copies of itself and spread from location to location within a system and/or from system to system. Typically, computer viruses spread without user knowledge or permission.
Some of the methods used to detect malicious code may include some form of heuristics logic to determine whether particular computer code is malicious. Heuristics logic applies rules to distinguish malicious code from non-malicious code. AV systems using heuristics logic may use self-educating techniques to improve performance.
When attempting to detect malicious code, heuristic detection methods may scan computer code to detect for malicious code. Some heuristic detection methods used by an AV system may provide “false results,” which may be caused for various reasons. There are generally two types of false results that may occur when heuristic logic is used to scan for malicious code. A false positive (Type I) result is sometimes also referred to as a false alarm and is one in which the AV system detects malicious code when in reality, the code is clean. A false negative (Type II) result is one in which the AV system fails to indicate that malicious code is present, when in fact it is. Either type of false result can have serious consequences. Type I false results can be a problem, since the “cure” to recover from the false result may cause actual problems with the system. Type II false results can be a problem, since the actual malicious code goes undetected, leaving it to possibly wreak havoc on the system and possibly replicate itself to other portions of the system or to other systems.
Different heuristic detection methods may require different amounts of time and/or utilize varying amounts of computer resources when analyzing for malicious code. In addition, there can be a tradeoff between accuracy in detection of the malicious code and the amount of time and/or computer resources required by the heuristic detection method. For example, heuristic detection methods logic utilizing less time and/or computer resources, will usually be less accurate in detection of malicious code than heuristic detection methods that utilize more time and/or computer resources. That is, when attempting to be more accurate, heuristics logic may require more time and/or system resources, in order to provide a more accurate conclusion. This may result in decreased performance of the system being analyzed for the malicious code.